6 ms·
This is a specific example of what should be a much more general practice: having separate protocols for establishing an initial contact and establishing a comm
by lisper 3y ago
This is a specific example of what should be a much more general practice: having separate protocols for establishing an initial contact and establishing a communications session with an already existing contact. My email spam filter is based on this. It does a first-stage separation between email from people I've corresponded with in the past and everything else. That simple heuristic is enough to achieve >99% accuracy all by itself.
- jowea 3y agoI navel-gaze that if we redesigned communications from the ground up we could handle this better. When you greet someone physically you can add each other as known trusted contacts immediately. And when you sign up to some service online and have to put in your contact info, which likewise prompts you to add them as contact. And you can't share along a contact you know to someone else without that contact ID uniquely identifying you. That way, everyone who should contact you can do so and if someone else gets their hand on your contact info you can figure out who leaked it.
- sspiff 3y agoI do this with my email. I have a bunch of different emails under my own domain, and I use info+uniqueidentifier@domain.org for registrations which do not warrant their own actual email handle. This way, I can easily filter incoming email, and I can see where an email came from if any party sells my data. This also works with GMail by the way, you can use youraccount+anyrandomstring@gmail.com and emails will still be delivered to you. I use a separate email handle that I only hand out to actual human beings, never to companies and never use for account registrations. This has worked really well for the past 15 years or so.
- wahnfrieden 3y agoApple has this as a service now. It's more automatic than the GMail process and works well. A weakness with the GMail process is that spammers are able to remove the + part (even if most don't), and your credentials or identity can be aligned across leaked credential databases by removing the + part.
- sspiff 3y agoThey can, but in my case that still doesn't get them in my inbox since those messages go elsewhere.
- jkaptur 3y agoIt seems like this approach is really popular. Have no spammers/data brokers caught on and started stripping the +identifier?
- aqfamnzc 3y agoIf they were really smart, they'd parse and use that info to their advantage. Have info+autozone@domain.com? Send company-specific phishing emails to +apple, +wellsfargo, +$POPULAR_COMPANY every other week
- myself248 3y agoCan't you just reject email that comes in to the base address without the identifier?
- jowea 3y agoI heard about the +, but don't some sites reject it? Or can't bad actors just strip it? You'd need your own domain with a large amount of unique identifiers for it to work if it became popular.
- heleninboodler 3y agoI find it quite rare for systems to reject the + these days. One notable exception is my credit union, whose Web 1.0 system turned it into a space. The most annoying thing about this practice is if you're telling it to a human, they are very confused about your email address having their company's name in it. I occasionally get "do you work here or something?" Every once in a while I'm talking to someone (example: elementary school secretary) who gives me a vibe that they're going to be really thrown off by this and I just make up a three letter unique code for a suffix since I can still search for whoever sent me that first to see what the suffix means. On the stripping of the + and suffix, yeah, bad actors who recognize your scheme can do that, but spamming is about quantity, not quality, so they just aren't going to put in the effort.
- nunez 3y agounfortunately, i disagree; i stopped using plus sign addressing because so many sites i wanted to use it on (many of them for important things like medical stuff) wouldn't accept it
- jowea 3y agoSpamming is about quantity but stripping a "+" is something a one line script can do, which is what will happen if this gets popular. A real solution should be more resilient. Like spam binning anything that does not use the "+" ?
- heleninboodler 3y agoWell, I've always thought it would be fairly easy to strip, but I've now been doing it for 25 years and it's obvious the spammers aren't going to go to even that small effort. I once heard the CEO of wordpress say that it would be easy for them to go after adblockers too, but they explicitly didn't because the userbase that went to the trouble of installing adblockers didn't tend to be a lucrative advertising demographic anyway. It's all about return on your investment.
- ninkendo 3y agoiCloud’s Hide My Email is perfect for this. No “+” convention, it just generates a random @icloud.com email address specifically for whatever website/app you’re signing up for, and forwards it to your real email. The random addresses are indistinguishable from real iCloud.com email addresses, there’s no naming convention a website can reject. I never worry about sites that require signups any more, I just autogenerate an email for them and use a fake name. I couldn’t give a shit less if they get hacked or leak data, because the email and password are randomly generated. If they turn out to spam me I just disable that email address and never hear from them again. The only people who have my “real” email addresses are people I know personally.
- FireBeyond 3y ago> The random addresses are indistinguishable from real iCloud.com email addresses, there’s no naming convention a website can reject. That's not remotely true. The very very very vast majority of actual iCloud email addresses are going to have "dictionary" names. It's quite trivial to detect a randomized address (and at that point, you probably don't even care about a couple of false positives). Multiple instances of letter-number-letter-number ("b2y4r")? Coupled with letter combinations that don't exist in most languages ("ytbn")? And no dictionary words ("john", "smith", "booklover")? Random address. Now, whether you care to do business with someone who detects this is a different question altogether. But they are absolutely distinguishable.
- ninkendo 3y agoThe auto-generated addresses also have dictionary names. They’re explicitly designed to look like addresses that a real person might come up with… typically a dictionary word, followed by some numbers and symbols. Just like other email addresses on popular services where all the good names are taken.
- FireBeyond 3y agoThe ones I've seen are like a987dfc429be@icloud.com. Same with Private Relay: here's one of mine (with one character changed) - 2he5rs923s@privaterelay.appleid.com
- chrisweekly 3y agoStepping back a bit, I find it kind of strange that knowledge of a 7-digit number is all that's required for anyone in the world to (by default) immediately interrupt someone.
- csallen 3y agoIn the prehistoric era (and continuing into the present day), all that's required to interrupt someone is a set of vocal chords you can use to talk to them, or a finger you can use to tap them on the shoulder, or a fist you can use to knock on their door. The universe isn't naturally shaped in a way that makes interrupting difficult, and never has been.
- bomewish 3y agoTechnology reducing distance kinda changes the game though.
- dghlsakjg 3y agoI'm pretty sure that if the phone system didn't exist, no one from a call center in South Asia would have ever come all the way to rural Canada to try to tell me I have a computer virus that they can fix for a few hundred dollars.
- erehweb 3y agoMaybe not exactly that, but traveling salesmen (snake oil, encyclopedias) used to be more of a thing.
- deleted 3y ago[deleted]
- cortesoft 3y agoYou also have to by physically near them. > The universe isn't naturally shaped in a way that makes interrupting difficult, and never has been. Yes it is... physical space is shaped to keep most people from being able to interrupt you. Being able to call anyone around the world changed that.
- thayne 3y agoI've though a little bit about what a good successor to email would look like, and in addition to things like native support for encryption and authentication, one of the big features I wanted was to put not allow sending a message unless the recipient had added you to their list of contacts. And maybe have a way to to send a request that someone add you to their contacts, that would be processed differently than a normal message.
- dghlsakjg 3y agoThat eliminates a huge class of genuinely useful use cases for email. Part of the usefulness is that you can write and receive to addresses without prior permission. I've had wonderful conversations with authors, academics, politicians and other strangers around the world thanks to the permissive ability of email.